linux-kernel - [PATCH] virt: vbox: fix possible circular timer scheduling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251122182142.5179-1-bigalex934@gmail.com>
Date: Sat, 22 Nov 2025 21:21:43 +0300
From: Alexey Simakov <bigalex934@...il.com>
To: Hans de Goede <hansg@...nel.org>
Cc: Alexey Simakov <bigalex934@...il.com>,
	Arnd Bergmann <arnd@...db.de>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Larry Finger <Larry.Finger@...inger.net>,
	linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org
Subject: [PATCH] virt: vbox: fix possible circular timer scheduling

According to timer.c documentation, callers of this function should ensure
the timer is not rearmed.  Meanwhile, the heartbeat callback may itself
reschedule the heartbeat timer which could lead to theoretically
indefinite loop iterations inside __timer_delete_sync(), due to a race
when the heartbeat callback is always running when it's attempted to be
detached.

Use timer_shutdown_sync() instead to avoid this issue.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 0ba002bc4393 ("virt: Add vboxguest driver for Virtual Box Guest integration"):
Signed-off-by: Alexey Simakov <bigalex934@...il.com>
---
 drivers/virt/vboxguest/vboxguest_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
index b177a534b6a4..508ba711669d 100644
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -495,7 +495,7 @@ static int vbg_heartbeat_init(struct vbg_dev *gdev)
  */
 static void vbg_heartbeat_exit(struct vbg_dev *gdev)
 {
-	timer_delete_sync(&gdev->heartbeat_timer);
+	timer_shutdown_sync(&gdev->heartbeat_timer);
 	vbg_heartbeat_host_config(gdev, false);
 	vbg_req_free(gdev->guest_heartbeat_req,
 		     sizeof(*gdev->guest_heartbeat_req));
-- 
2.34.1